CVE-2024-45438

critical · 9.1

An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.

9.1

CVSS

0.6%

EPSS (exploit prob.)

46th

EPSS percentile

2025-08-21

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-284CWE-306

References

https://docs.titanhq.com/en/13161-spamtitan-release-notes.html
https://seclists.org/fulldisclosure/2025/Sep/15
https://www.seralys.com/research/CVE-2024-45438.txt
https://www.titanhq.com/email-protection/
http://seclists.org/fulldisclosure/2025/Sep/15

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-45438